Start with onboarding
A named next action
Assign a task where the team is already coordinating the incident.
MSSP/MDR · People
Keep incident work on the case.
One room for the response team.
Coordinate participants and tasks in the case's War Room, with the investigation close at hand. Your team can run available playbooks from the case when permitted and review execution status alongside the evidence, so follow-up work stays connected to the incident it serves.
Participants on the caseTasks with an ownerPlaybook execution status
NS-104: Privileged account activityNorthstar
Team Members
A. RiveraIncident lead
M. KayaSecurity analyst
- Case
- NS-104
- Customer
- Northstar
- Title
- Privileged account activity
Tasks
Collect sign-in logsA. Rivera
DoneA. RiveraConfirm with the customerA. Rivera
OpenA. RiveraWar Room Chat
A. Rivera: Sign-in logs are attached to the case.
Add Task
Team Members
A. RiveraIncident lead
M. KayaSecurity analyst
- Case
- NS-104
- Customer
- Northstar
- Title
- Privileged account activity
Tasks
Collect sign-in logsA. Rivera
DoneA. RiveraConfirm with the customerA. Rivera
OpenA. RiveraReset the service accountM. Kaya
OpenM. KayaAssigned To: M. Kaya
M. KayaTeam Members
A. RiveraIncident lead
M. KayaSecurity analyst
J. DahlSecurity analyst
- Case
- NS-104
- Customer
- Northstar
- Title
- Privileged account activity
War Room ChatA. RiveraJ. Dahl, please review the sign-in evidence.J. DahlI will review the case and coordinate with M. Kaya.M. KayaThe reset task is assigned to me.
A. RiveraJ. Dahl, please review the sign-in evidence.J. DahlI will review the case and coordinate with M. Kaya.M. KayaThe reset task is assigned to me.Tasks
Reset the service account remains assigned to M. Kaya.
Internal SOC Team
Tasks
Collect sign-in logsA. Rivera
DoneA. RiveraConfirm with the customerA. Rivera
OpenA. RiveraReset the service accountM. Kaya
OpenM. KayaWar Room Chat
M. Kaya: Checking the playbook execution before updating the case.
Playbooks
Containment: NorthstarStarted by A. Rivera
RunningA. Rivera- Case
- NS-104
- Customer
- Northstar
- Execution
- In progress
Investigation
Review execution status alongside the case evidence.
Available playbooks, when permitted
Playbooks run from the case when permitted. Review execution status alongside the investigation.
A. Rivera and M. Kaya coordinate the Northstar investigation in its War Room.
Add a task to reset the service account and assign it to M. Kaya.
Bring J. Dahl, an internal analyst, into the response team.
Run an available playbook from the case when permitted, then check its execution status.
Illustrative customer workflow
01 - What it does
Keep follow-up work with the investigation.
An incident needs coordination as well as evidence. The War Room gives your team a place on the case to coordinate participants and tasks, so the next analyst can pick up the work in context.
Give the next action an owner.
Use the task list to give follow-up work an owner. The War Room sits on the case, beside the evidence and notes used in the investigation. Review permitted playbook execution there too, so the incoming analyst can see the outstanding work and its context at handoff.
The coordination happens on the case, so the incident record is complete.
NS-104: War RoomExample
- Participants
- 3
- Open tasks
- 2
- Playbooks
- 1 running
- Customer
- Northstar
Illustrative customer and values. Not customer performance data.
Context at handoff
Return to the case for tasks and the investigation that prompted them.
02 - How it works in the product
Coordinate, act and check the result.
Start from the customer case your team is working. Use its War Room to coordinate the response, then review permitted playbook execution without separating the action from the investigation.
- 01Casebook
Open the customer case and review the evidence already attached to it.
- 02War Room
Coordinate the participants and tasks for this incident.
- 03Tasks
Assign follow-up work to an analyst so its owner is clear.
- 04Casebook
Run an available playbook when permitted and review its execution status.
Casebook comes with every tier. Available playbooks depend on the enabled modules and permissions; playbook automation is outside The Portal's default module set.
03 - How it connects
Make coordination part of case work.
Casebook holds the investigation record. Automatio provides playbook workflows where licensed, while Virtus Pilot supports investigation where its module is enabled. The War Room gives your team a place to coordinate the human work.
Works with
In the editions
The Portal, Autonomous SOC and SecOps PlatformIncluded
Casebook is included. Playbook and AI capabilities follow their own module entitlements.
04 - What it means for your service
Leave the next analyst a usable record.
Keep coordination attached to the incident while the response is under way. When the case closes, its evidence and recorded decision give your team a basis for review instead of a fresh reconstruction.
Less handoff reconstruction
Find tasks beside the investigation instead of collecting a separate task list.
Actions remain reviewable
Check playbook execution status alongside the case that prompted the run.
A basis for the customer review
Use the case evidence and closure reason to explain the recorded outcome.
Start with one customer
- 01Choose a customer case
Open a case with a follow-up action your team needs to coordinate.
- 02Assign one task
Make the task and its owner explicit in the War Room.
- 03Review the outcome
Check execution status and write a useful closure reason when the work is done.
Questions about War Room.
1Where do incident tasks live?
The case's War Room holds the task list for coordinating incident work. Participants and tasks stay on the case, close to its investigation context.
2Can we run a playbook from the case?
Run available playbooks from the case when permitted, then review execution status alongside the investigation. Playbook availability depends on enabled modules and permissions; playbook automation is outside The Portal's default module set.
3What remains after a case closes?
A closed case can retain its evidence, timeline, disposition and closure reason for review. Closing a case is distinct from deleting it; a useful closure reason helps the next analyst understand the decision.
Have any other questions? Talk to our team
Keep the response team
close to the investigation.
Walk through incident coordination and permitted playbook execution with the Imperum team.